magus v0.4.3 is out. See what's new
¶ View markdown source · ✎ Suggest an edit
1 min read

MGS9019: invalid token record skipped

A file in $XDG_STATE_HOME/magus/tokens.d holds a record that magus config ... create could never have written. The store skips that one file: it verifies nothing, lists nowhere, and every other token keeps working. magus doctor fails its tokens check naming the file, and the server logs it once.

[MGS9019] auth: token record /path/tokens.d/laptop.json is skipped: tokens=write
is the operator's alone; remove it (`rm /path/tokens.d/laptop.json`) and mint
its replacement
  see: .../MGS9019.md

Why

A record is held at load to every rule a mint is held to, so a file planted in tokens.d, by hand or by any process that can write there, cannot grant more than one minted there. The rules:

  • a stored token never holds tokens=write, which is the operator's alone, and grants something the grant model knows;
  • it expires, after it was created, at most 366 days later (a link's one-time code: at most a minute);
  • it was not created in the future;
  • its name is the file's name, is a valid name, and does not look like an id;
  • its id is the first 8 hex of a well-formed SHA-256.

The guard is a seatbelt here, not a boundary: a process running as you can write the file whatever magus says. What magus enforces is that the file cannot escalate once written.

Resolution

Remove the file the message names and mint what it should have been:

rm <file>
magus config console token create --name <name>      # a browser
magus config mcp connector create --name <name>      # an MCP client

If you did not put the file there, treat the machine as untrusted until you know what did.

See also

MGS9019authtokenstoretokens.ddoctor
Last updated (95680f58)
Earlier changes on this page (1)

Full history ↗ · Blame source ↗

Glossary

Op

A single tool-native command a target composes (long form: operation); the middle of the work hierarchy (Spell to Op to Target). See operations.

Server

The background process a person starts with magus server start. It serves MCP, the console, background jobs and the warm knowledge graph, and adopts nested magus calls into one pool. See server.

Run

One target executing under one magus invocation, such as magus run test web or magus affected ci. A run keeps its captured output behind an output reference. Every magus run is a run whether or not any job asked for it; see Job for how the two relate.

Conventions

This page uses none of the site's convention markers. The full set is on the conventions page.